xbase-util 0.8.5__tar.gz → 0.8.6__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {xbase_util-0.8.5 → xbase_util-0.8.6}/PKG-INFO +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/setup.py +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/pcap_util.py +7 -8
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/test.py +0 -6
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/PKG-INFO +1 -1
- {xbase_util-0.8.5 → xbase_util-0.8.6}/README.md +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/setup.cfg +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/add_column_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/common_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/dangerous_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/ConfigBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/CurrentConfigBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/FlowBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/TaskTemplateBean.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/bean/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/ConfigDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/CurrentConfigDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/FlowDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/TaskTemplateDao.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/dao/__init__.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/db/initsqlite3.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/es_db_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/esreq.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/geo_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/handle_features_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/packet_util.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util/xbase_constant.py +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/SOURCES.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/dependency_links.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/not-zip-safe +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util.egg-info/top_level.txt +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util_assets/GeoLite2-City.mmdb +0 -0
- {xbase_util-0.8.5 → xbase_util-0.8.6}/xbase_util_assets/arkimeparse.js +0 -0
@@ -366,8 +366,8 @@ def reassemble_tcp_pcap(p):
|
|
366
366
|
info[key]['max'] = seq
|
367
367
|
packets2.append(packet)
|
368
368
|
if len(keys) == 1:
|
369
|
-
key = f"{
|
370
|
-
ack =
|
369
|
+
key = f"{packets2[0]['pkt'][IP].dst}:{packets2[0]['pkt'][IP].dport}"
|
370
|
+
ack = packets2[0]['pkt'][TCP].ack
|
371
371
|
info[key] = {
|
372
372
|
"min": ack,
|
373
373
|
"max": ack,
|
@@ -375,8 +375,7 @@ def reassemble_tcp_pcap(p):
|
|
375
375
|
"wrapack": False,
|
376
376
|
}
|
377
377
|
keys.append(key)
|
378
|
-
|
379
|
-
if len(packets) == 0:
|
378
|
+
if len(packets2) == 0:
|
380
379
|
return []
|
381
380
|
needwrap = False
|
382
381
|
if info[keys[0]] and info[keys[0]]['max'] - info[keys[0]]['min'] > 0x7fffffff:
|
@@ -388,13 +387,13 @@ def reassemble_tcp_pcap(p):
|
|
388
387
|
info[keys[0]]['wrapack'] = True
|
389
388
|
needwrap = True
|
390
389
|
if needwrap:
|
391
|
-
for packet in
|
390
|
+
for packet in packets2:
|
392
391
|
key = f"{packet['ip']['addr1']}:{packet['tcp']['sport']}"
|
393
392
|
if info[key]['wrapseq'] and packet['tcp']['seq'] < 0x7fffffff:
|
394
393
|
packet['tcp']['seq'] += 0xffffffff
|
395
394
|
if info[key]['wrapack'] and packet['tcp']['ack'] < 0x7fffffff:
|
396
395
|
packet['tcp']['ack'] += 0xffffffff
|
397
|
-
clientKey = f"{
|
396
|
+
clientKey = f"{packets2[0]['pkt'][IP].src}:{packets2[0]['pkt'][IP].sport}"
|
398
397
|
|
399
398
|
def compare_packets(a, b):
|
400
399
|
a_seq = a['pkt'][TCP].seq
|
@@ -413,14 +412,14 @@ def reassemble_tcp_pcap(p):
|
|
413
412
|
return (a_seq + len(a_data) - 1) - b_ack
|
414
413
|
return a_ack - (b_seq + len(b_data) - 1)
|
415
414
|
|
416
|
-
|
415
|
+
packets2.sort(key=cmp_to_key(compare_packets))
|
417
416
|
# del packets[num_packets:]
|
418
417
|
# Now divide up conversation
|
419
418
|
clientSeq = 0
|
420
419
|
hostSeq = 0
|
421
420
|
previous = 0
|
422
421
|
results = []
|
423
|
-
for i, item in enumerate(
|
422
|
+
for i, item in enumerate(packets2):
|
424
423
|
sip = item['pkt'][IP].src
|
425
424
|
sport = item['pkt'][IP].sport
|
426
425
|
seq = item['pkt'][TCP].seq
|
@@ -1,13 +1,7 @@
|
|
1
|
-
import re
|
2
|
-
from collections import Counter
|
3
|
-
|
4
|
-
import numpy as np
|
5
1
|
from scapy.packet import Raw
|
6
2
|
from scapy.utils import rdpcap
|
7
3
|
|
8
|
-
from xbase_util.common_util import get_res_status_code_list
|
9
4
|
from xbase_util.pcap_util import reassemble_tcp_pcap, reassemble_session_pcap
|
10
|
-
from xbase_util.xbase_constant import res_status_code_pattern
|
11
5
|
|
12
6
|
if __name__ == '__main__':
|
13
7
|
packets_scapy = reassemble_tcp_pcap(rdpcap("gzip2.pcap"))
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|